sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

s3:libsmb: add trust_pw_change()

Browse Source 
This protects the password change using a domain specific g_lock,
so multiple parts 'net rpc', 'rpcclient', 'winbindd', 'wbinfo --change-secret'
even on multiple cluster nodes doesn't race anymore.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2013-09-15 13:19:52 +02:00
parent d1340c20b0
commit 16c6e4992f
2 changed files with 187 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
source3/include/proto.h
View File

@ -977,6 +977,14 @@ void update_trustdom_cache( void );
NTSTATUS trust_pw_find_change_and_store_it(struct rpc_pipe_client *cli,
TALLOC_CTX *mem_ctx,
const char *domain) ;
struct netlogon_creds_cli_context;
struct messaging_context;
struct dcerpc_binding_handle;
NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
struct messaging_context *msg_ctx,
struct dcerpc_binding_handle *b,
const char *domain,
bool force);
/* The following definitions come from param/loadparm.c */

179
source3/libsmb/trusts_util.c
View File

@ -20,12 +20,15 @@
#include "includes.h"
#include "../libcli/auth/libcli_auth.h"
#include "../libcli/auth/netlogon_creds_cli.h"
#include "rpc_client/cli_netlogon.h"
#include "rpc_client/cli_pipe.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
#include "secrets.h"
#include "passdb.h"
#include "libsmb/libsmb.h"
#include "source3/include/messages.h"
#include "source3/include/g_lock.h"
/*********************************************************
Change the domain password on the PDC.
@ -113,3 +116,179 @@ NTSTATUS trust_pw_find_change_and_store_it(struct rpc_pipe_client *cli,
return nt_status;
}
struct trust_pw_change_state {
struct g_lock_ctx *g_ctx;
char *g_lock_key;
};
static int trust_pw_change_state_destructor(struct trust_pw_change_state *state)
{
g_lock_unlock(state->g_ctx, state->g_lock_key);
return 0;
}
NTSTATUS trust_pw_change(struct netlogon_creds_cli_context *context,
struct messaging_context *msg_ctx,
struct dcerpc_binding_handle *b,
const char *domain,
bool force)
{
TALLOC_CTX *frame = talloc_stackframe();
struct trust_pw_change_state *state;
struct samr_Password current_nt_hash;
const struct samr_Password *previous_nt_hash = NULL;
enum netr_SchannelType sec_channel_type = SEC_CHAN_NULL;
const char *account_name;
char *new_trust_passwd;
char *pwd;
struct dom_sid sid;
time_t pass_last_set_time;
struct timeval g_timeout = { 0, };
int timeout = 0;
struct timeval tv = { 0, };
NTSTATUS status;
state = talloc_zero(frame, struct trust_pw_change_state);
if (state == NULL) {
TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
state->g_ctx = g_lock_ctx_init(state, msg_ctx);
if (state->g_ctx == NULL) {
TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
state->g_lock_key = talloc_asprintf(state,
"trust_password_change_%s",
domain);
if (state->g_lock_key == NULL) {
TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
g_timeout = timeval_current_ofs(10, 0);
status = g_lock_lock(state->g_ctx,
state->g_lock_key,
G_LOCK_WRITE, g_timeout);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("could not get g_lock on [%s]!\n",
state->g_lock_key));
TALLOC_FREE(frame);
return status;
}
talloc_set_destructor(state, trust_pw_change_state_destructor);
if (!get_trust_pw_hash(domain, current_nt_hash.hash,
&account_name,
&sec_channel_type)) {
DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
TALLOC_FREE(frame);
return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
}
switch (sec_channel_type) {
case SEC_CHAN_WKSTA:
pwd = secrets_fetch_machine_password(domain,
&pass_last_set_time,
NULL);
if (pwd == NULL) {
TALLOC_FREE(frame);
return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
}
break;
case SEC_CHAN_DOMAIN:
if (!pdb_get_trusteddom_pw(domain, &pwd, &sid, &pass_last_set_time)) {
TALLOC_FREE(frame);
return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
}
break;
default:
TALLOC_FREE(frame);
return NT_STATUS_NOT_SUPPORTED;
}
timeout = lp_machine_password_timeout();
if (timeout == 0) {
if (!force) {
DEBUG(10,("machine password never expires\n"));
TALLOC_FREE(frame);
return NT_STATUS_OK;
}
}
tv.tv_sec = pass_last_set_time;
DEBUG(10, ("password last changed %s\n",
timeval_string(talloc_tos(), &tv, false)));
tv.tv_sec += timeout;
DEBUGADD(10, ("password valid until %s\n",
timeval_string(talloc_tos(), &tv, false)));
if (!force && !timeval_expired(&tv)) {
TALLOC_FREE(frame);
return NT_STATUS_OK;
}
/* Create a random machine account password */
new_trust_passwd = generate_random_password(frame,
DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
if (new_trust_passwd == NULL) {
DEBUG(0, ("generate_random_password failed\n"));
TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
status = netlogon_creds_cli_auth(context, b,
current_nt_hash,
previous_nt_hash);
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(frame);
return status;
}
status = netlogon_creds_cli_ServerPasswordSet(context, b,
new_trust_passwd, NULL);
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(frame);
return status;
}
DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n",
current_timestring(talloc_tos(), False)));
/*
* Return the result of trying to write the new password
* back into the trust account file.
*/
switch (sec_channel_type) {
case SEC_CHAN_WKSTA:
if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
TALLOC_FREE(frame);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
break;
case SEC_CHAN_DOMAIN:
/*
* we need to get the sid first for the
* pdb_set_trusteddom_pw call
*/
if (!pdb_set_trusteddom_pw(domain, new_trust_passwd, &sid)) {
TALLOC_FREE(frame);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
break;
default:
break;
}
TALLOC_FREE(frame);
return NT_STATUS_OK;
}